nerdexam
Cisco

200-301 · Question #970

Refer to the exhibit. A network engineer started to configure port security on a new switch. These requirements must be met: - MAC addresses must be learned dynamically - Log messages must be generate

The correct answer is A. SW(ccnfig-if)#switchport port-security mac-address sticky B. SW(config-if)#switchport port-security violation restriction restrict. To configure port security to dynamically learn MAC addresses and generate log messages without disabling the interface upon violations, the switchport port-security mac-address sticky command should be used for learning, and switchport port-security violation restrict for the de

Submitted by marco_it· Mar 5, 2026Network Access

Question

Refer to the exhibit. A network engineer started to configure port security on a new switch. These requirements must be met: - MAC addresses must be learned dynamically - Log messages must be generated without disabling the interface when unwanted traffic is seen Which two commands must be configured to complete this task? (Choose two)

Exhibits

200-301 question #970 exhibit 1
200-301 question #970 exhibit 2

Options

  • ASW(ccnfig-if)#switchport port-security mac-address sticky
  • BSW(config-if)#switchport port-security violation restriction restrict
  • CSW(config-if)#switchport port-security mac-address 0010.7B84.45E6
  • DSW(config-if)#switchport port-security maximum 2
  • ESW(ccnfig-if)#switchport port-security violation shutdown

How the community answered

(25 responses)
  • A
    80% (20)
  • C
    4% (1)
  • D
    12% (3)
  • E
    4% (1)

Why each option

To configure port security to dynamically learn MAC addresses and generate log messages without disabling the interface upon violations, the `switchport port-security mac-address sticky` command should be used for learning, and `switchport port-security violation restrict` for the desired violation mode.

ASW(ccnfig-if)#switchport port-security mac-address stickyCorrect

The `switchport port-security mac-address sticky` command enables sticky learning, which dynamically learns MAC addresses and stores them in the running configuration, meeting the requirement for dynamic learning.

BSW(config-if)#switchport port-security violation restriction restrictCorrect

The `switchport port-security violation restrict` command sets the violation mode to restrict, which drops violating frames, increments a security violation counter, and generates an SNMP trap and a syslog message, satisfying the requirement to generate log messages without disabling the interface.

CSW(config-if)#switchport port-security mac-address 0010.7B84.45E6

`switchport port-security mac-address 0010.7B84.45E6` statically configures a MAC address, which contradicts the requirement for dynamically learned MAC addresses.

DSW(config-if)#switchport port-security maximum 2

`switchport port-security maximum 2` limits the number of learned MAC addresses but doesn't fulfill the requirements for dynamic learning or the specific violation action.

ESW(ccnfig-if)#switchport port-security violation shutdown

`switchport port-security violation shutdown` causes the interface to shut down when a security violation occurs, which goes against the requirement to NOT disable the interface.

Concept tested: Cisco switch port security configuration (sticky MAC, violation modes)

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_44_se/configuration/guide/scg/swportsc.html

Topics

#port security#sticky MAC#violation mode#switchport

Community Discussion

No community discussion yet for this question.

Full 200-301 Practice